Privacy Policy

Information for clients on what information I collect and why

Your privacy is very important to me. This notice explains how I collect, use, store, and protect your personal information from the first point of contact, throughout your therapy, and after therapy ends. I follow all relevant UK data protection laws including the General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and the British Association for Counselling and Psychotherapy Ethical Framework.

I am the Data Controller for Lumi Counselling.

1. What personal information I collect and why

I collect only the information that is necessary to provide safe and effective counselling. This includes:
Contact and identity information

• Your name, date of birth, and address. These are required for safeguarding and accurate client identification.
• Your email address and telephone number. These are used only for arranging, cancelling, or confirming appointments unless you agree to receive additional information by email.

GP information

I ask for the name of your GP practice and their contact details as part of my commitment to your safety and well-being. Collecting this information is considered best practice within counselling and supports my duty of care. GP information is only used in rare circumstances where there is a serious safeguarding concern. In such situations, I may contact your GP or another appropriate service to support your safety. I will always aim to discuss this with you first unless safety reasons prevent this.
This information is treated as special category personal data under UK GDPR. It is processed under the lawful basis of contract or legitimate interest, depending on your stage in therapy and under Article 9 for health or social care purposes.

Session notes

I keep brief, anonymised factual notes to support our therapeutic work. Notes do not contain identifiable personal details. They are stored securely and separately from your personal details form.

Payment information

Payments are made via bank transfer. Your name may appear on my bank statement. If I need to share statements for accounting purposes, I will redact your name where possible. My name will appear on your bank statement. Banks are subject to GDPR, so your confidentiality is protected.

Why this data is collected

I collect only the minimum personal data necessary to provide counselling safely, meet professional and legal obligations, follow BACP standards, and comply with insurance and safeguarding requirements.

2. Lawful basis for processing

The lawful basis depends on the stage of therapy.

If you are considering therapy or are currently in therapy, your information is processed under contract because it is necessary for me to provide counselling.

After therapy ends, your information is processed under legitimate interest to comply with legal, professional, and continuity of care requirements.

For special category data, processing is based on Article 9 for health or social care purposes.

3. How your information is stored

I take data security very seriously.

Personal details forms are kept in locked storage accessible only to me. Session notes are stored separately from personal data. Emails, phone, and laptop are password-protected and have antivirus software. Email correspondence that is not needed for administrative purposes is deleted within one month. Printed documents are stored securely in a locked cabinet.

4. Confidentiality

Everything shared in therapy remains confidential except when:

• You disclose information indicating a serious risk of harm to yourself or others
• There is a safeguarding concern involving a child or vulnerable adult
• You disclose information related to certain criminal activities
• I am legally compelled by a court
• My clinical supervisor supports my work. Your identity is never revealed.

Whenever possible, I will discuss any need to break confidentiality with you first.

5. Data retention

Personal details are securely destroyed at the end of therapy. Session notes are stored securely for five years. Name, date of birth, and client reference number are retained for the same period to comply with insurance (Holistic) and legal requirements. After the retention period, all data is confidentially destroyed.

6. Clinical will

I have a clinical will to ensure continuity and safety. In the event of my serious illness or death, a qualified counsellor or therapeutic supervisor will contact you to let you know what has happened. They will securely archive or destroy your notes according to legal and insurance requirements. They may also offer support in continuing therapy or provide signposting to alternative services if appropriate.

7. Third-party data sharing

Your information is only shared when necessary. My accountant may see anonymised financial records. Your contact information is never shared for marketing, research, or non-essential purposes. Session content is only shared with your written consent or if legally or ethically required.

8. Website visitors

If you contact me via the website form, your information is transmitted securely via encrypted email and is not stored on the website. The website uses cookies and Google Analytics to help understand how visitors use the site. Some features, such as interactive maps, may also use cookies. You can opt out of Google Analytics and related services using Google’s opt-out tools.

9. Your Rights Under UK GDPR

You have the right to:

• Access the personal data I hold about you
• Request correction of inaccurate information
• Request deletion of your data in some circumstances
• Restrict or object to certain types of processing
• Receive a copy of your data
• Make a complaint to the Information Commissioner’s Office if you believe your data has been handled improperly

I aim to respond to access requests within ten working days.

10. Contact information

Data Controller
Kira Gruber, Lumi Counselling
ICO Registration Number ZC051770
Email kiragruber@lumicounselling.com
Phone 07345 505137

11. Complaints

If you have concerns about how your personal information is handled, please contact me directly. You can also raise a formal complaint with the Information Commissioner’s Office at www.ico.org.uk/make-a-complaint.

12. Updates to this privacy notice

This policy may be updated occasionally. Please check this page for the most current version.
Kira Gruber, Lumi Counselling 2025